The Role of “Notified Digital Evidence Examiners”

I refer to one such report in Economic Times under the title “India to finally get electronic evidence authenticators”which inter-alia made a statement

“In a move that will aid investigators and prosecutors, the Centre has finally decided to appoint “Examiners of Electronic Evidence“ who will be the only ones authorized to tell courts if an e-evidence is authentic “

This statement is incorrect and misleading and needs to be clarified.

In the same article, a senior IPS officer is quoted which reflects  a correct understanding. He says

“The first line of argument from the defence is that the footage or voice is doctored. Presently, material is sent to forensic labs based on court direction on a case-to-case basis. But we need one or more authenticators to who we can straight away go even before taking it to the court.Their seal and sign must qualify as concrete attestation before any court.”

Digital Evidence is presently part of almost all Court proceedings. In the past they have been used successfully to prosecute the offenders in cases both under ITA 2000/8 or IPC. The first case in which conviction was obtained with the use of electronic evidence being the main evidence to prove the crime was the “Suhaskatti Case” (Details available in two part judgement reproduced)  way back in 2004. Subsequently several Courts have taken cognizance of electronic evidence. The latest important judgement is the judgement of the Supreme Court in what is called the “Basheer Case”.

Other than these, several Courts have used electronic evidence to prove facts in a litigation both civil and criminal.

It is not as if the Courts have not admitted and appreciated any electronic evidence so far. In the past whenever an electronic evidence is presented in the Court, the evidence is first admitted on the basis of Section 65B certification. Later during trial, if any of the defendants have an objection, they may produce their own expert opinion to counter the evidence. The Court if it needs may then call a Forensic Expert acceptable to it to give his opinion in the matter.

This process will continue.

Presently Police often were requesting the Court for permission to send a seized hard disk or mobile to a Government Forensic Lab (There are a few private labs whose services have been used by the Police from time to time) and then the Government lab gives its analysis which is presented by the prosecution in the Court. If the Police proceeds with analysis without such a Court permission, there is fear that the evidence may be considered as having been unauthorizedly tampered with and the findings rejected. Hence Police will now be happy to get the notified labs to whom they can send the evidence. Obviously, such labs will be the CFSL and State level forensic labs.

By this notification, the Police may be able to speed up their investigation so that they can take the assistance of these accredited labs at the investigation stage itself.

If the defendant disputes the evidence he may request for a fresh independent analysis by requesting for a Cloned copy of the hard disk. The two experts may be cross examined in the Court to satisfy the Court one way or the other.

Section 79A is an enabling provision which states as under.

79A Central Government to notify Examiner of Electronic Evidence

The Central Government may, for the purposes of providing expert opinion on electronic form evidence before any court or other authority specify, by notification in the official Gazette, any department, body or agency of the Central Government or a State Government as an Examiner of Electronic Evidence.

Explanation:- For the purpose of this section, “Electronic Form Evidence” means any information of probative value that is either stored or transmitted in electronic form and includes computer evidence,digital audio,digital video,cell phones,digital fax machines”.

This section was introduced with the Information Technology Amendment Act 2008 and became effective from 27th October 2009. Under this provision the Central Government was empowered (Note the word “may”) to appoint any “agency of the Central or State Government” as an “Examiner of Electronic Evidence”. This is not meant for individual experts but only for an organization.

It is expected that the organization would follow certain standard practices which make their process reliable enough for the Court to consider the evidence certified by it as authentic enough to proceed with the trial.

It will be a standard process in all such forensic investigations that the lab will on receipt of a material (container of electronic document such as a hard disk, mobile, CD, pen drive etc”) create cloned copies so that any request for production of the evidence in the form in which it was presented to them is fulfilled.

We need to note that this would require money to be invested in buying additional hard disks and devices similar to the evidentiary objects. For example, if 10 hard disks are presented as evidence by the Police, the lab has to buy 10 similar hard disks to keep a cloned version of the hard disks. The Police would also perhaps have a cloned copy of their own created at the time of seizure. Thus there will be a proliferation of digital evidence storage devices and the labs will have to ensure that budgets for such expenses are provided for.

Why Digital Evidence Examiner’s Certification should be discretionary not mandatory?

Electronic evidence is admitted as evidence based on its Section 65B certification. This will be prima facie evidence for trial purpose.  Then the trial begins when one of the parties presents its findings of the evidence.  At this point of time, the interpretation of the evidence as presented by the presenter of the evidence will be admitted  as long as the evidence is  not challenged by the defendant.

This situation will be similar to say a signed letter presented in evidence on which the signature of the defendant is not challenged. If the signature is challenged in such cases,  the Court may invite a signature or handwriting expert to give his views.

Similarly, any electronic evidence admitted in a Court can be proceeded with without a further certification from the “Digital Evidence Examiner”. Where the Court on its own decision or when the evidence is disputed, it may be mandatory to seek the opinion of the examiner notified under Section 79A. However, the opinion of the examiner may still be challenged by the defense.

It will be the discretion of the Court to decide how much value they would place on the evidence before the certificate of the Digital Evidence Examiner and after such certification.

Meeting “Admissibility” criteria under Section 65B of IEA is mandatory but requiring the Certificate of a Digital Evidence Examiner need not be considered as “Mandatory”. It is discretionary.

Police may still consider it as a Best Practice

However, practically, Police may not like to present evidence in their hands without this certification so that they are not accused of shoddy investigation. So, in practice Police may adopt a practice of sending every electronic evidence for “Digital Evidence Examination” in an accredited lab.

The certification may improve the “Probative Value” of the evidence and make it more difficult for the defendant to get it termed “unreliable” by the Court.

But just because an evidence is certified by a “Digital Evidence Examiner”, Court cannot refuse to allow the defendant to question the evidence. This would amount to trampling of the rights of the defendant. 

In future Courts and the Police  need to dispassionately consider whether it is practical to send all digital evidence to such labs as a mandatory process and if so whether it is feasible to close any case in which Cyber evidence is involved (Which is almost hundred percent of all investigations) within reasonable time.

Imagine that in the case of every civil and criminal case involving written document, every such document has to be sent to a handwriting expert for certification. Such a demand would be impractical. However, in the interest of justice whenever there is a slight doubt about the authenticity of a written document, it is prudent to send it for the views of a handwriting expert.

Imagine the investigation of the molestation case which Bangalore police cracked recently from CCTV footage and Mobile Tower data. There will be hundreds of such cases in which truck loads of evidence in digital devices would be used and if all these are to be certified in the accredited labs, we are looking at a practical impossibility.

Hence, we should accept that the use of Digital Evidence Examiner should be considered as “discretionary” and not “mandatory”.  Whenever there is a “reasonable” (standard of reasonableness can be low to begin with) doubt as to the authenticity of an electronic document presented as evidence, then Courts may adopt a mandatory requirement of examination by an “accredited digital evidence examiner” (Which is an organization and not an individual) while the Police will continue to have the discretion to adopt it as a “Best Practice”.

I however state that if it is considered mandatory and all digital evidence is dumped on such labs, there will be a serious hit on the trials and the cyber criminals will be happy with the delays.

Despite what I have stated above, the notification was long overdue and is welcome. It was a necessary follow up of the ITA 2008 which was left unattended. Hence we welcome the move with caution.

Naavi